Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bed34c870e0244a…

MALICIOUS

PDF

21.2 KB Created: 2020-02-10 00:10:07 +00:00 Authoring application: mPDF 5.7
MD5: b236616cc451582ed1d5d4322a611543 SHA-1: 021d4997782966662d3b94b9f885a692642ee5b6 SHA-256: 7bed34c870e0244a2c30e9c8b38d50c46bb18b3ceef898928f87c3445f10790f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files hosted on the domain 'ieuicufioao.myhome.cx'. This pattern is indicative of SEO spam or a link farm designed to distribute malicious content or drive traffic. The ML classifier also flagged this PDF with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ieuicufioao.myhome.cx/5557553557557559/Inside-the-Tardis-The-Worlds-of-Doctor-Who-by-James-Chapman.pdf
    • http://ieuicufioao.myhome.cx/5557553557558555/Doctor-Who-T-is-for-TARDIS-by-Adam-Howling.pdf
    • http://ieuicufioao.myhome.cx/5557553558551554/Doctor-Who-The-Secrets-of-the-TARDIS-by-Oli-Smith.pdf
    • http://ieuicufioao.myhome.cx/3551556558554559/Doctor-Who---The-What-Where-and-How-A-Fannish-Guide-to-the-TARDIS-Sized-Pop-Culture-Jam-by-Valerie-Estelle-Frankel.pdf
    • http://ieuicufioao.myhome.cx/5557553558556558/TARDIS-Eruditorum---A-Critical-History-of-Doctor-Who-Volume-3-Jon-Pertwee-by-Philip-Sandifer.pdf
    • http://ieuicufioao.myhome.cx/5557553559551550/TARDIS-Eruditorum---An-Unofficial-Critical-History-of-Doctor-Who-Volume-5-Tom-Baker-and-the-Williams-Years-by-Philip-Sandifer.pdf
    • http://ieuicufioao.myhome.cx/2557559555554554/Doctor-Who-The-Road-to-the-Thirteenth-Doctor-1-Tenth-Doctor-Special-by-James-Peaty.pdf
    • http://ieuicufioao.myhome.cx/8558550553558550/Inside-Outside-Life-Between-Two-Worlds-by-Andrew-Riemer.pdf
    • http://ieuicufioao.myhome.cx/1550556550555555556/Doctor-Who-and-Philosophy-Bigger-on-the-Inside-by-Ed-Webb.pdf
    • http://ieuicufioao.myhome.cx/2553550553556550/Inside-Inside-by-James-Lipton.pdf
    • http://ieuicufioao.myhome.cx/7558552554556554/The-Worlds-Trilogy-Worlds-Worlds-Apart-and-Worlds-Enough-and-Time-by-Joe-Haldeman.pdf
    • http://ieuicufioao.myhome.cx/8557555555552/The-Great-Science-Fiction-The-Time-Machine-The-Island-of-Doctor-Moreau-The-Invisible-Man-The-War-of-the-Worlds-Short-Stories-by-H-G-Wells.pdf
    • http://ieuicufioao.myhome.cx/8555551556557559/Handbook-of-Grammar-and-Composition-by-James-A-Chapman.pdf
    • http://ieuicufioao.myhome.cx/2552556552558558/Safe-Patients-Smart-Hospitals-How-One-Doctor-s-Checklist-Can-Help-Us-Change-Health-Care-from-the-Inside-Out-by-Peter-Pronovost.pdf
    • http://ieuicufioao.myhome.cx/2550555555555552/Death-and-the-Chapman-Roger-the-Chapman-1-by-Kate-Sedley.pdf
    • http://ieuicufioao.myhome.cx/1558555556555553/Doctor-No-James-Bond-6-by-Ian-Fleming.pdf
    • http://ieuicufioao.myhome.cx/2551550552555552/What-the-Doctor-Ordered-by-Sierra-St-James.pdf
    • http://ieuicufioao.myhome.cx/1558553559553550/Doctor-in-the-Andes-by-Dana-James.pdf
    • http://ieuicufioao.myhome.cx/2556556554555/Alternate-Worlds-The-Illustrated-History-of-Science-Fiction-by-James-E-Gunn.pdf
    • http://ieuicufioao.myhome.cx/7558557555554551/Doctor-Who-Summer-Falls-by-James-Goss.pdf
    • http://ieuicufioao.myhome.cx/5557553559551550/TARDIS-Eruditorum---An-Unoffici

Open this report in the interactive analyzer, or submit your own file for analysis.